Quiz Entry - updated: 2026.10.22
What does this command do: ldapsearch -h ldap.acme.com -p 389 -s sub -D "cn=Directory Manager,o=acme" -W -b "ou=personen,o=acme" "(&(mail=joe*)(c=germany))" mail?
It connects to ldap.acme.com on port 389, binds as the Directory Manager (asking for the password interactively), searches the whole subtree below ou=personen,o=acme for entries whose mail starts with "joe" and whose country is Germany, and returns only their mail attribute.
Taking it apart:
| Part | Meaning |
|---|---|
-h ldap.acme.com -p 389 |
Server host and port (389 = plain LDAP) |
-D "cn=Directory Manager,o=acme" |
The bind DN: who is logging in |
-W |
Prompt for the password instead of putting it on the command line |
-b "ou=personen,o=acme" |
Base DN: start the search at the persons branch |
-s sub |
Scope: the base and everything below it |
"(&(mail=joe*)(c=germany))" |
Filter: mail starts with joe AND country is germany |
mail |
Attribute list: return only the mail attribute |
Two refinements for real use:
- Current OpenLDAP tools take the server as a URI:
-H ldap://ldap.acme.com:389(orldaps://...); the old-h/-poptions no longer appear in the current manual. - The standard
cattribute holds a two-letter ISO 3166 code, so a correctly populated directory needs(c=DE), not(c=germany).
Binding as the all-powerful Directory Manager for a simple lookup also breaks least privilege; a read-only service account would be the safer choice.
Go deeper:
ldapsearch manual page (OpenLDAP) — every option, including -H, -b, -s, -D and -W.